JS/Trojan.redirector.cay false postive?

[CRHC]

Hello,

Starting from what appears to be right after pattern update 683-936 was committed - we began receiving a very substantial amount of alerts from multiple internal "victims" for this Trojan.  I am still investigating this internally.  Has anyone else had a large amount of activity on this signature starting recently? Looking to verify if this is a false positive or not.  Other AV protection layers are not reporting this type of activity.  Thanks.

Name:	JS/Trojan.redirector.cay
ID:	250007
Severity:
Description:	This signature detected JS/Trojan.redirector.cay

[mmorfoot]

I am seeing this as well.  I thought maybe it was a single website, but from the looks of it, I think it just may be a false positive.  I have identified the source IP's as being owned by a company called AppNexus (at least this is our case).  I'm still investigating myself.

[CRHC]

Thank you for the update from your end as well.  I updated to the latest version a few minutes ago and no change.  Events still showing up.

Antivirus version

684-937 (2012/02/20)

[n.flanagan]

We also have a lot of these. The ones I have examined are from adnxs.com, which appears to be an advertising site. Brightcloud categorizes it as Trustworthy.

We also seem to have URL filtering categorizing a lot of advertisers like atdmt.com and doubleclick.net as malware sites.

Neil Flanagan

[u10723]

We are also seeing a high number of these.  Have the latest and greatest defenitions as well.

[mlane]

I was seeing the exact same problems.  Multiple blocks of JS/Trojan.redirector.cay as threat, and atdmt.com and doubleclick.net are blocked as malware-sites.  Google Maps and Mapquest will not work.

I received an email that it was indeed a false positive on JS/Trojan.redirector.cay and that it would be corrected in the next update.

[tettema]

This signature is a confirmed false positive.  It has been removed for tomorrow's AV content release.

[acwsupport]

I want to update the AV manually later. Can you provide which AV version have fixed this issue?

[acwsupport]

Anyone can help to confirm which AV version have fixed the "JS/Trojan.redirector.cay false positive" issue?

We have opened a tech support case with case no. 00066795 to get the AV version number. The funny thing is the engineer still asking me for pcap. If the signature is removed I cannot get packet capture based on threat id in threat logs. :smileyconfused:

[skrall · Accepted solution]

Content version 686-XXX has the fix.

When we get a report of a false positive we usually ask for the following.

show system info

-- To  see all currently installed software.

Threat logs that you believe to be a false positive.

Traffic logs for the IP address identified in the Threat log.

If the firewall is configured to save a PCAP of the packet that triggered the threat we ask for this as well.

If the threat was triggered by a URL or a file download, we would like this information to try and reproduce internally.

Thanks,

Steve Krall